I've sat in war rooms while dashboards lit up red and watched senior engineers scramble to figure out why a single TCP connection was eating 40% of a server's CPU. It wasn't a volumetric flood. It wasn't even that much traffic by bandwidth standards. What we were looking at was something far more insidious — a protocol-level exploit that turned the web's greatest efficiency feature into a weapon.
That was before CVE-2023-44487, the HTTP/2 Rapid Reset attack, became public knowledge. Now we know exactly what happened in those war rooms: attackers weren't flooding your network with garbage data. They were abusing a legitimate protocol mechanism — the RST_STREAM frame — to make your servers do expensive work on requests that never actually existed.
Here's the thing most teams get wrong. They think DDoS protection is about bandwidth. It isn't, not anymore. The HTTP/2 Rapid Reset attack peaked at over 398 million requests per second against Google's infrastructure, according to their own blog. But that traffic didn't come from a botnet of thousands of compromised devices pumping out megabits. It came from attackers who understood something about HTTP/2 that most operators don't: every stream you open costs you memory, CPU cycles for header parsing, and connection table entries. And if you can cancel those streams faster than your server can process them, you've found a free lunch — except the lunch is your availability.
This isn't theoretical. Dark Reading reported that telcos and healthcare providers were hit hard, with some carriers seeing attack traffic exceeding 50,000 RST_STREAM frames per second. These aren't organizations that can afford downtime. They're the ones keeping hospitals running and phones working.
For a deeper look at how this vulnerability specifically impacts distributed infrastructure in healthcare and telecommunications, see our coverage on HTTP/2 Rapid Reset: Protecting Distributed Infrastructure.
Sources: Dark Reading – HTTP/2 Bomb Attacks Hit Telcos and Healthcare | Google Cloud Blog – How It Works: The Novel HTTP/2 Rapid Reset DDoS Attack | BleepingComputer – HTTP/2 Rapid Reset Attack Exploited in Zero-Day DDoS Campaigns